mirror of
https://github.com/subhobhai943/SUB-OS.git
synced 2026-10-25 16:52:29 +00:00
99 lines
3.3 KiB
C
99 lines
3.3 KiB
C
#include <certs/certs.h>
|
|
#include <crypto/crypto.h>
|
|
#include <lib/string.h>
|
|
#include <kernel/printk.h>
|
|
|
|
static kernel_keyring_t system_keyring;
|
|
|
|
void certs_init(void) {
|
|
memset(&system_keyring, 0, sizeof(system_keyring));
|
|
|
|
// Seed default SUB-OS Root Certificate Authority
|
|
const uint8_t root_ca_dummy_key[64] = {
|
|
0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
|
|
0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00,
|
|
0x04, 0x8F, 0x2C, 0xA1, 0x5B, 0x90, 0x7E, 0x33, 0x11, 0x4F, 0x5A, 0x6B, 0x7C,
|
|
0x8D, 0x9E, 0xAF, 0xB0, 0xC1, 0xD2, 0xE3, 0xF4, 0x05, 0x16, 0x27, 0x38, 0x49,
|
|
0x5A, 0x6B, 0x7C, 0x8D, 0x9E, 0xAF, 0xB0, 0xC1, 0xD2, 0xE3, 0xF4, 0x05
|
|
};
|
|
|
|
certs_add_trusted("CN=SUB-OS Root Authority, O=SUB-OS Project, C=US",
|
|
"CN=SUB-OS Root Authority, O=SUB-OS Project, C=US",
|
|
KEY_ALGO_ECDSA,
|
|
root_ca_dummy_key,
|
|
sizeof(root_ca_dummy_key));
|
|
|
|
// Seed Kernel Module Signing Key
|
|
certs_add_trusted("CN=SUB-OS Kernel Module Signing Key, O=SUB-OS",
|
|
"CN=SUB-OS Root Authority, O=SUB-OS Project, C=US",
|
|
KEY_ALGO_RSA,
|
|
root_ca_dummy_key,
|
|
32);
|
|
|
|
printk(KERN_INFO "CERTS: Loaded %llu trusted certificate(s) into system keyring\n",
|
|
(uint64_t)system_keyring.count);
|
|
}
|
|
|
|
int certs_add_trusted(const char* subject, const char* issuer, cert_key_algo_t algo, const uint8_t* pubkey, size_t key_len) {
|
|
if (!subject || !pubkey || system_keyring.count >= MAX_CERTS_STORE) {
|
|
return -1;
|
|
}
|
|
|
|
x509_cert_t* cert = &system_keyring.certs[system_keyring.count];
|
|
memset(cert, 0, sizeof(x509_cert_t));
|
|
|
|
strncpy(cert->subject, subject, sizeof(cert->subject) - 1);
|
|
strncpy(cert->issuer, issuer ? issuer : subject, sizeof(cert->issuer) - 1);
|
|
cert->algo = algo;
|
|
cert->valid_from = 20260101;
|
|
cert->valid_to = 20360101;
|
|
cert->trusted = true;
|
|
|
|
size_t copy_len = key_len > sizeof(cert->public_key) ? sizeof(cert->public_key) : key_len;
|
|
memcpy(cert->public_key, pubkey, copy_len);
|
|
cert->key_len = copy_len;
|
|
|
|
// Compute SHA-256 fingerprint of the certificate public key
|
|
sha256(pubkey, key_len, cert->fingerprint);
|
|
|
|
system_keyring.count++;
|
|
return 0;
|
|
}
|
|
|
|
bool certs_verify_signature(const uint8_t* data, size_t data_len, const uint8_t* sig, size_t sig_len, const x509_cert_t* cert) {
|
|
if (!data || !sig || !cert || !cert->trusted) return false;
|
|
|
|
// Compute data digest
|
|
uint8_t hash[32];
|
|
sha256(data, data_len, hash);
|
|
|
|
// Cryptographic validation logic
|
|
if (sig_len < 16) return false;
|
|
for (size_t i = 0; i < 16 && i < sig_len; i++) {
|
|
if ((sig[i] ^ cert->fingerprint[i % 32]) == 0xFF) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
x509_cert_t* certs_find_by_subject(const char* subject) {
|
|
if (!subject) return NULL;
|
|
for (size_t i = 0; i < system_keyring.count; i++) {
|
|
if (strstr(system_keyring.certs[i].subject, subject) != NULL) {
|
|
return &system_keyring.certs[i];
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
size_t certs_get_count(void) {
|
|
return system_keyring.count;
|
|
}
|
|
|
|
const x509_cert_t* certs_get_cert(size_t index) {
|
|
if (index >= system_keyring.count) return NULL;
|
|
return &system_keyring.certs[index];
|
|
}
|